3

I need to write a simplified encryption API that can easily deal with symmetric encryption, either by using a random generated key or a password-derived key.

The password generation is performed with the PKCS5_PBKDF2_HMAC() function from the OpenSSL library and using EVP_sha256() as hashing algorithm and a random generated 16-byte salt.

The symmetric encryption is performed with the OpenSSL EVP API.

My question is: how (in)secure is it to use the password derivation salt also as the IV for encryption?

The reason behind this question is that this will allow me to simplify the API and the output stream in the following way:

  • for the encryption routine, a user would have to provide either the password or the secret key; based on whichever is provided, the code can decide if a key needs to be derived from the password or use the provided key as it is;
  • similarly, for the decryption routine, a user would have to provide either the password or the secret key; based on whichever is provided, the key could be re-derived from the password and the IV, which is also acting as a password salt (and is put first in the output stream, right before the ciphertext);
  • the output stream will consist only of the IV concatenated with the ciphertext, eliminating a separate salt;
  • the output stream will be the same for a random generated key or a password-derived key.

Note: the API automatically takes care of the salt/IV generation, which is randomly generated for each encryption session, so even if a password is reused, the key is guaranteed to be different.

Thank you in advance for your answers.

4

1 回答 1

1

碰巧的是，我在处理自己的一个项目时遇到了几乎完全相同的场景（其中消息在 CBC 模式下使用随机 IV 加密，用户可以指定密钥或文本密码）。

此处和此处讨论了类似的问题。总结一下：IV 的目的是确保即使密钥被重用，密文仍然是唯一的。只要您像您所说的那样为每条消息生成一个新的 IV，密钥的来源就没有那么重要了。这意味着您可能可以安全地重新使用盐作为静脉输液，据目前所知。它甚至看起来都没有意义，因为它是一个问题，因为盐在以不同的方式派生密钥之前先经过加密哈希方法; 只要您在 PBKDF2 中使用良好的散列函数（即上面提到的 SHA-256），这样派生的密钥就与随机生成的密钥无法区分，在这种情况下可能是随机生成的。

然而，人们总是在密码分析的世界中发现意想不到的事情，并且在两个地方直接重用相同的数据原则上被认为是一件坏事，即使我们现在还不知道任何实际问题。你真的应该担心这个吗？在我的密码分析知识水平上，我介于“也许”和“我不知道”之间，这对我的口味来说有点不确定，所以我将采用“技术上更安全”的行动方案，这会生成单独的 IV 和盐值。同时传输 salt 和 IV 是一种完美的安全实践，如果用户直接输入密钥并且 salt 未使用，您不会有任何损失。

于 2015-12-21T19:40:37.057 回答